What licence renewal and variation means in South Africa's crypto regime
South Africa's Financial Sector Conduct Authority (FSCA) now formally classifies crypto asset service providers (CASPs) as financial service providers (FSPs) under the Financial Advisory and Intermediary Services Act regime, making licence renewal and variation live regulatory obligations – not administrative formalities. For any business that provides financial services in relation to crypto assets to South African clients, maintaining a valid CASP FSP authorisation is the foundation of lawful operation. Let a renewal lapse or expand services without a variation approval, and the business faces suspension, enforcement action and the near-certain closure of local and correspondent banking rails. This page sets out how the renewal and variation cycle works, what the FSCA expects at each stage, and where cross-border complexity sharpens the risk.
The FSCA, which administers the Financial Sector Regulation Act as the primary conduct regulator, began accepting CASP registration applications in June 2023 and moved to a mandatory licensing posture shortly after. Businesses that obtained initial CASP FSP authorisation are now inside the renewal cycle for the first time. The variation mechanism – used whenever the scope of authorised services changes – runs in parallel and carries its own procedural requirements.
The regulated basis: FSCA, the FSP regime and crypto asset classification
South Africa classifies crypto assets as a financial product, placing any intermediary or advisory function within the ambit of FAIS and the FSCA's licensing regime. The FSCA issued a formal declaration under the applicable FAIS provisions, which means a crypto exchange, OTC desk, custody operator or advisory platform touching South African clients needs CASP FSP authorisation as a condition of lawful business. This is not a voluntary sandbox or transitional carve-out; it is the operative licensing requirement for the market today.
The category structure mirrors the broader FSP regime. Different service types – dealing as principal, dealing as agent, custody, advice – map to distinct sub-categories. A business authorised for one sub-category cannot expand into another without a formal variation. This matters enormously for exchanges that evolved from spot trading into custody, staking or yield services: each expansion of the service perimeter is a licensable event.
The FSCA has also signalled alignment with FATF Recommendation 15 on virtual assets, meaning the Travel Rule (the obligation to pass originator and beneficiary data with a transfer) sits alongside the licensing requirements as a parallel compliance layer. Both must be in order at renewal time.
How does the CASP FSP renewal process work in practice?
Renewal under the FSCA framework follows a structured filing cycle tied to the authorisation anniversary date. The authority expects the licensee to file a renewal application within the prescribed window before expiry – filing late does not automatically preserve the authorisation, and the window is short enough that it demands active calendar management. In our licensing practice, we routinely begin renewal preparation several months before the trigger date, because the documentation burden and the fit-and-proper checks for key individuals take meaningful time to compile correctly.
The core renewal package typically includes updated fit-and-proper declarations for all key individuals (representatives and compliance officers), current audited financials, a confirmation of continued professional indemnity insurance at the prescribed level, and an attestation that the business's operational profile still falls within the originally authorised sub-categories. If any element has drifted – new products, new key individuals, restructured ownership – those changes must be disclosed and, where material, addressed by a concurrent variation application. Submitting a renewal that understates operational change is not a conservative strategy; the FSCA conducts profile checks, and a mismatch invites a supervisory query that can delay or derail the renewal entirely.
Capital adequacy is assessed at renewal. The prescribed capital requirement varies by sub-category, and a business that has grown should verify that its current own-funds position meets the threshold applicable to its full authorised scope – not just the sub-categories it was originally granted.
What triggers a variation and how is the application structured?
A variation application to the FSCA is required whenever the business seeks to add a new CASP sub-category, add or remove a key individual, change the compliance officer, or alter the ownership structure beyond the thresholds prescribed by the regime. The variation process is a standalone filing: it is not bundled into an annual renewal automatically, and approval is required before the expanded service can lawfully commence.
In our experience, the most common variation triggers for South African-licensed CASPs are three: adding a custody sub-category to an existing trading authorisation; onboarding a new qualified compliance officer after a departure; and structural changes following an investment round that changes the shareholding profile. Each of these is routine in a growing digital-asset business, and each requires documented FSCA notification or approval before the change becomes operative.
The application structure for a variation mirrors the initial authorisation in miniature. The business submits a variation request form, supporting documentation for the new sub-category or changed individual, and, where ownership changes are involved, full beneficial ownership disclosure to the FSCA. The authority reviews for fit-and-proper compliance and for whether the business has the operational capacity – systems, controls, qualified representatives – to support the expanded authorisation. A business that adds custody without demonstrating adequate segregation and safeguarding controls will face questions it needs to be ready to answer.
To map the renewal and variation timeline for your current authorisation scope, contact OBOLUS at info@oboluslaw.com. The process above describes the standard path. Your facts – the entity structure, the service mix, the compliance officer position – change the analysis, and a scoped review before the filing window opens is almost always the more efficient approach.
How does cross-border structure affect renewal and variation in South Africa?
For a business with an operating entity in South Africa and a holding structure offshore – whether in a BVI, Cayman or ADGM vehicle – the renewal and variation cycle creates a point of intersection that catches operators off guard. The FSCA assesses the local entity against its licensing requirements; but changes at holding-company level that affect the beneficial ownership or control of the South African CASP are disclosable events under the applicable regime.
An investment round that brings in a new anchor investor at the BVI holding-company level can, depending on the ownership thresholds the FSCA applies, require a variation notification in Johannesburg even though the local entity's day-to-day operations are unchanged. We advise operators to map the FSCA disclosure obligations into their transaction structuring process at the term-sheet stage, not after signing. Discovering a variation obligation post-closing adds regulatory risk and potential deal complexity if the investor is subject to enhanced fit-and-proper scrutiny.
Banking is a second cross-border pressure point. South African banks have historically applied conservative policies to CASP clients, and a renewal filing that discloses service expansion – particularly into cross-border stablecoin transfers or yield services – can prompt a correspondent bank review. Businesses whose banking relationships are credit-sensitive should time renewal and variation filings with awareness of their banking covenants and reporting obligations. Where the banking stack sits offshore (a common arrangement for exchanges serving pan-African markets from a South African CASP licence), the renewal confirmation from the FSCA should be delivered promptly to the offshore banking partner as a condition-precedent or covenant compliance matter.
AML, the Travel Rule and what the FSCA expects at renewal
Renewal is an FSCA compliance checkpoint, and AML/CFT programme adequacy is on the examiner's list. Under the Financial Intelligence Centre Act (FICA), CASPs are accountable institutions subject to know-your-customer, transaction monitoring and record-keeping obligations. The FSCA will expect, at a minimum, confirmation that the business has a current risk-based AML programme in place, that it has registered with the Financial Intelligence Centre (FIC) as an accountable institution, and that its compliance officer has the requisite skills and authority.
The Travel Rule dimension adds complexity for exchanges operating across borders. South Africa's FIC has signalled alignment with FATF standards, which means originator and beneficiary data obligations apply to crypto asset transfers at or above the applicable threshold. A business renewing its FSCA authorisation while also operating cross-border transfer services needs to demonstrate that its Travel Rule compliance infrastructure – the data-collection, screening and transmission architecture – is operational, not merely documented in a policy. Regulators in the leading hubs increasingly expect evidence of technology integration, not just a written programme.
A practical illustration: renewal with a concurrent custody variation
In a recent licensing matter, a digital-asset exchange holding an initial South African CASP FSP authorisation for trading and advice services sought to add a custody sub-category ahead of a planned institutional client launch. The renewal date and the custody expansion timeline converged within the same quarter. We structured a concurrent filing – renewal package and variation application submitted together – with supporting documentation that addressed the FSCA's safeguarding expectations for the custody service, including a new compliance officer appointment and an updated professional indemnity policy. The variation was approved within the renewal cycle, allowing the institutional product to launch without a gap in authorisation. The cross-border holding structure required a parallel ownership-change notification to the FSCA, which was addressed in the same filing window.
What mistakes do operators make at the renewal and variation stage?
The most damaging mistake is treating renewal as a box-ticking exercise rather than a substantive compliance review. A business that files a renewal package that accurately describes its authorised scope but does not disclose that its operational profile has expanded – new products, new markets, changed key individuals – creates a material misrepresentation risk. If the FSCA subsequently identifies the discrepancy through a supervisory review or a market complaint, the enforcement exposure is significantly higher than it would have been if the business had filed a proactive variation at the right time.
A second common mistake is under-resourcing the fit-and-proper process for key individuals. The FSCA's fit-and-proper requirements cover honesty and integrity, competence and qualifications, and operational ability. Key individuals who joined the business after initial authorisation need to be assessed and declared. A business that brings in a new CEO or head of compliance without notifying the FSCA is operating outside its licence conditions, even if nothing else has changed.
A third failure point is the professional indemnity insurance gap. Coverage must be maintained continuously, and the renewal package must confirm current, adequate cover. A lapse between policy periods – even a short administrative lapse – is a defect in the renewal filing. In our practice, we conduct a pre-filing insurance audit as a standard step to catch this before it becomes a problem.
A common assumption in the market is that a single offshore CASP licence or a registration in a lighter-touch jurisdiction is sufficient to serve South African clients without local FSCA authorisation. That assumption is incorrect. The FSCA applies a substance-and-nexus test: if the service is marketed to or received by South African clients, the local licensing requirement is engaged regardless of where the entity is domiciled. We have seen this issue surface most sharply for businesses that licensed in the BVI or Cayman Islands and then expanded their marketing to South African institutional clients without re-examining the local regulatory position.
Which operators most need counsel at the renewal and variation stage?
Not every renewal requires the same level of engagement. The decision turns on the complexity of the business's profile at the filing date.
An exchange with a stable service mix, unchanged key individuals and a clean compliance record can manage renewal with structured internal preparation and a counsel review of the final package before submission. The risk profile is low; the principal task is documentation discipline.
A business that has expanded its service perimeter since initial authorisation – added custody, launched a staking product, onboarded institutional clients with bespoke service arrangements – should treat the renewal as a substantive regulatory engagement. The concurrent variation process requires careful scoping; the FSCA may request additional information, and the timeline must allow for a response cycle without threatening the renewal date.
A business undergoing ownership change, management transition or a cross-border restructuring at the same time as renewal faces the highest complexity. These situations require the renewal, the variation and any change-of-control notifications to be sequenced and filed in a coordinated way. A misordered filing can create a gap in authorisation that has banking and operational consequences. We advise businesses in this profile to engage counsel at least three months before the renewal window opens.
If your renewal window is approaching and your operational profile has changed, write to OBOLUS at info@oboluslaw.com. If a prior filing stalled or a variation was declined, a structured review of the reasons can surface the path back to authorisation.
Related at OBOLUS
- Licensing and registration for digital-asset businesses – the full scope of our CASP and FSP licensing work across jurisdictions.
- Licence renewal and variation: legal counsel for digital-asset firms – scoped counsel service for businesses approaching a renewal or variation filing.
- Tokenised fund structuring: practical lessons for boards – structuring considerations relevant to South African-licensed entities with fund or custody components.
FAQ
How long does a crypto licence take to obtain?
In South Africa, the FSCA CASP FSP authorisation process typically runs over several months from a complete filing. The timeline depends on the sub-categories applied for, the fit-and-proper documentation for key individuals, and whether the FSCA issues queries. A well-prepared application with clean documentation and qualified key individuals will move faster than one that requires iterative supplementation. Cross-border structures with offshore holding companies generally add a documentation layer that extends the process.
Which jurisdiction is best for licensing my crypto business?
There is no single answer. South Africa provides access to the local market and is aligned with FATF standards, but it does not passport across other African jurisdictions or into the EU. Businesses serving clients across multiple regions typically require a multi-jurisdiction licence stack. The right combination depends on where your clients are, where your entity sits, where your banking lives, and which services you offer. We map that stack across the licensing, tax and banking layers before you commit to a structure.
Do I need a separate custody licence?
Under the South African FSCA regime, custody of crypto assets is a distinct sub-category of CASP FSP authorisation. A business authorised only for trading or advice does not automatically have authority to provide custody. Adding custody requires a formal variation application, and the FSCA will assess the business's operational controls, safeguarding arrangements and compliance infrastructure before granting the additional sub-category. Exchanges planning to offer self-custody alternatives or institutional custody solutions should address this at the structural planning stage.
About OBOLUS
OBOLUS is an independent digital-asset law boutique acting only for businesses. We advise crypto exchanges, custodians, token issuers and funds on licensing across more than seventy jurisdictions – including South Africa and the broader FATF-aligned hubs – on disputes and on-chain asset recovery across more than twenty-five forums, and on the tax, banking and compliance that sit around them. We map the licence stack across operating, custody and payment layers before you commit, so that renewal cycles and service expansions do not become enforcement events. Digital assets are the whole of our practice. To discuss your situation, contact info@oboluslaw.com.
By Aisha Tan, Licensing & Jurisdictions Analyst – specialising in CASP authorisation, renewal and variation across African and emerging-market regulatory regimes.
This publication is general information about the law and does not constitute legal advice. It is not a substitute for advice tailored to your circumstances. OBOLUS accepts no liability for action taken or not taken on the basis of this material. For advice on your situation, contact info@oboluslaw.com.